MCP server intelligence profile

ApiTap MCP Server

MCP server that turns any website into an API by capturing or importing API endpoints, enabling AI agents to interact with web services without a browser, with 20-100x token cost reduction versus browser automation

Local Onlyn1byn1kt
Awaiting current scanNpm · 2.2.2

The selected current version does not yet have completed public verification. Unknown does not mean clean or vulnerable.

1Distribution channel
12Independently observed tools
0Linked remote endpoints
AvailableVersion intelligence

Detailed security scan evidence is not public for this MCP yet. Public identity, registry metadata, and independently observed protocol inventory remain available.

Install and connect

Installation and connection instructions are shown only when supported by retained package, repository, or endpoint evidence.

Install @apitap/core from npm

Version 2.2.2 declares 1 executable entrypoint.

npm install --save-exact @apitap/core@2.2.2
npx -y -p @apitap/core@2.2.2 @apitap/core
MCP client configuration example
{
  "mcpServers": {
    "@apitap/core": {
      "command": "npx",
      "args": [
        "-y",
        "-p",
        "@apitap/core@2.2.2",
        "@apitap/core"
      ]
    }
  }
}

Identity

Canonical slugapitap-91a6e840DeploymentLocal Only
Canonical packagenpm:@apitap/coreRepositoryn1byn1kt/apitap
First published—Latest release—
Last security verification—Classification confidence90%
PublicationDraftOfficial distributionNot verified

Distributions

ChannelIdentifierCurrent versionVersionsSource
npm@apitap/core2.2.266Repository

Current release

PackageVersionPublished / observedInventorySecurity scan
npm@apitap/core2.2.2CurrentSep 5, 202612 toolsSucceeded · 0 resources · 0 promptsEvidence restricted
Enterprise protection

Continuously monitor this MCP for security risk

Independently scan the exact version your agents use, receive alerts when its risk changes, and investigate every finding with retained version evidence.

  • Independent exact-version security scans
  • Continuous release and vulnerability monitoring
  • Risk-change alerts with capability context
  • Historical evidence and API exports
Custom pricingContact salesTailored to your organization, integrations, data needs, and support requirements.

Current version evidence

No public current-version evidence is available yet.

Current protocol inventory

2025-06-18Negotiated protocol
apitapServer-reported name
1Capability groups
Aug 14, 2026Observed

Tools 12

ToolCategoryAnnotationsRisk
apitap_auth_requestOpen a visible browser for human login (handles 2FA, CAPTCHAs). The user must CLOSE THE BROWSER WINDOW when they are done logging in — this is the signal that authentication is complete. Tell the user to close the browser after login. Stores session tokens encrypted — auto-injected on future replay/capture calls.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "description": "Domain to authenticate (e.g. \"github.com\")"
    },
    "loginUrl": {
      "description": "Login page URL (defaults to https://<domain>)",
      "type": "string"
    },
    "timeout": {
      "description": "Timeout in seconds for human to complete login (default: 300)",
      "type": "number"
    }
  },
  "required": [
    "domain"
  ]
}
Annotations
{
  "readOnlyHint": false,
  "openWorldHint": true
}
—WritesOpen world—
apitap_browseGet data from a URL in one call: checks skill files, runs discovery, replays best endpoint. Returns { success, data, domain, endpointId, tier } or { success: false, suggestion } if capture needed.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "URL to browse (e.g. \"https://zillow.com/rentals/portland\")"
    },
    "task": {
      "description": "Optional task description (e.g. \"find apartments under $1500\") — passed through in response for correlation",
      "type": "string"
    },
    "maxBytes": {
      "description": "Maximum size in bytes of the full serialized response. Large responses are truncated to fit.",
      "type": "number"
    }
  },
  "required": [
    "url"
  ]
}
Annotations
{
  "readOnlyHint": true,
  "openWorldHint": true
}
—Read onlyOpen world—
apitap_captureLaunch a browser to capture a site's API traffic and save skill files for replay. Returns { domains, totalRequests, skillFiles }.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "URL to capture (e.g. \"https://polymarket.com\")"
    },
    "duration": {
      "description": "Capture duration in seconds (default: 30)",
      "type": "number"
    }
  },
  "required": [
    "url"
  ]
}
Annotations
{
  "readOnlyHint": false,
  "destructiveHint": false,
  "openWorldHint": true
}
—WritesNon-destructiveOpen world—
apitap_capture_finishFinish a capture session: verifies endpoints and writes skill files. Pass abort:true to close without saving. Returns { aborted, domains }.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "sessionId": {
      "type": "string",
      "description": "Session ID from apitap_capture_start"
    },
    "abort": {
      "description": "Abort without saving (default: false)",
      "type": "boolean"
    }
  },
  "required": [
    "sessionId"
  ]
}
Annotations
{
  "readOnlyHint": false,
  "destructiveHint": false,
  "openWorldHint": false
}
—WritesNon-destructiveClosed world—
apitap_capture_interactDrive a live capture session browser. Actions: snapshot, click (ref), type (ref+text), select, navigate, scroll, wait. Returns updated page snapshot after each action. Use element refs (e.g. "e0") from snapshots.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "sessionId": {
      "type": "string",
      "description": "Session ID from apitap_capture_start"
    },
    "action": {
      "type": "string",
      "enum": [
        "snapshot",
        "click",
        "type",
        "select",
        "navigate",
        "scroll",
        "wait"
      ],
      "description": "Action to perform"
    },
    "ref": {
      "description": "Element ref from snapshot (e.g. \"e0\") — required for click, type, select",
      "type": "string"
    },
    "text": {
      "description": "Text to type — required for type action",
      "type": "string"
    },
    "value": {
      "description": "Option value — required for select action",
      "type": "string"
    },
    "url": {
      "description": "URL — required for navigate action",
      "type": "string"
    },
    "direction": {
      "description": "Scroll direction (default: down)",
      "type": "string",
      "enum": [
        "up",
        "down"
      ]
    },
    "seconds": {
      "description": "Seconds to wait (max 10) — for wait action",
      "type": "number"
    },
    "submit": {
      "description": "Press Enter after typing (default: false)",
      "type": "boolean"
    }
  },
  "required": [
    "sessionId",
    "action"
  ]
}
Annotations
{
  "readOnlyHint": false,
  "destructiveHint": false,
  "openWorldHint": true
}
—WritesNon-destructiveOpen world—
apitap_capture_startStart an interactive capture session. Launches browser, begins capturing API traffic. Returns sessionId and page snapshot. Drive with apitap_capture_interact, save with apitap_capture_finish.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "URL to navigate to (e.g. \"https://polymarket.com\")"
    },
    "headless": {
      "description": "Run browser in headless mode (default: true)",
      "type": "boolean"
    },
    "allDomains": {
      "description": "Capture traffic from all domains, not just the target (default: false)",
      "type": "boolean"
    }
  },
  "required": [
    "url"
  ]
}
Annotations
{
  "readOnlyHint": false,
  "destructiveHint": false,
  "openWorldHint": true
}
—WritesNon-destructiveOpen world—
apitap_discoverProbe a site's APIs without a browser: detects frameworks, finds OpenAPI specs, probes common paths. Returns { confidence, skillFile?, frameworks?, hints }. High/medium confidence generates a skeleton skill file ready to replay.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "URL to discover (e.g. \"https://example.com\")"
    }
  },
  "required": [
    "url"
  ]
}
Annotations
{
  "readOnlyHint": true,
  "openWorldHint": true
}
—Read onlyOpen world—
apitap_peekHTTP HEAD triage of a URL — checks accessibility, bot protection, framework. Returns { accessible, recommendation, botProtection, framework }.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "URL to peek at (e.g. \"https://example.com\")"
    }
  },
  "required": [
    "url"
  ]
}
Annotations
{
  "readOnlyHint": true,
  "openWorldHint": true
}
—Read onlyOpen world—
apitap_readExtract content from a URL without a browser. Uses native APIs for Reddit/YouTube/Wikipedia/HN, HTML extraction elsewhere. Returns clean markdown. ~10K tokens vs 200K for browser.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "URL to read (e.g. \"https://en.wikipedia.org/wiki/TypeScript\")"
    },
    "maxBytes": {
      "description": "Maximum size in bytes of the full serialized response. Large responses are truncated to fit.",
      "type": "number"
    },
    "scan": {
      "description": "Enable trap-aware content scanning (default: true). Set to false to skip scanning and preserve the legacy response envelope shape.",
      "type": "boolean"
    },
    "includeImages": {
      "description": "Include the images array (deduped, capped at 50). Default: false.",
      "type": "boolean"
    }
  },
  "required": [
    "url"
  ]
}
Annotations
{
  "readOnlyHint": true,
  "openWorldHint": true
}
—Read onlyOpen world—
apitap_replayCall a captured API endpoint and return live data. Requires domain and endpointId from apitap_search. Pass params for path variables, query params, or body variables (e.g. "variables.limit": "25" for GraphQL).
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "description": "Domain of the API (e.g. \"gamma-api.polymarket.com\")"
    },
    "endpointId": {
      "type": "string",
      "description": "Endpoint ID from search results (e.g. \"get-events\", \"post-graphql-GetPosts\")"
    },
    "params": {
      "description": "Optional key-value parameters: path params (id), query params, or body variables (variables.limit for GraphQL)",
      "type": "object",
      "properties": {},
      "additionalProperties": {}
    },
    "fresh": {
      "description": "Force token refresh before replay (opens browser to capture fresh CSRF/session tokens)",
      "type": "boolean"
    },
    "maxBytes": {
      "description": "Maximum size in bytes of the full serialized response. Large responses are truncated to fit.",
      "type": "number"
    },
    "egress_check": {
      "description": "Per-call egress check override. false forces off; \"annotate\" or \"block\" force on with that action. Unset falls through to skill file and global config.",
      "anyOf": [
        {
          "type": "boolean",
          "const": false
        },
        {
          "type": "string",
          "enum": [
            "annotate",
            "block"
          ]
        }
      ]
    }
  },
  "required": [
    "domain",
    "endpointId"
  ]
}
Annotations
{
  "readOnlyHint": true,
  "openWorldHint": true
}
—Read onlyOpen world—
apitap_replay_batchReplay multiple captured endpoints in parallel across domains. Returns array of { domain, endpointId, status, data, error? } — failures are isolated per request.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "requests": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "domain": {
            "type": "string",
            "description": "Domain of the API"
          },
          "endpointId": {
            "type": "string",
            "description": "Endpoint ID from search results"
          },
          "params": {
            "description": "Optional key-value parameters",
            "type": "object",
            "properties": {},
            "additionalProperties": {}
          }
        },
        "required": [
          "domain",
          "endpointId"
        ]
      },
      "description": "Array of replay requests to execute in parallel"
    },
    "maxBytes": {
      "description": "Maximum size in bytes of the full serialized response. Large responses are truncated to fit.",
      "type": "number"
    }
  },
  "required": [
    "requests"
  ]
}
Annotations
{
  "readOnlyHint": true,
  "openWorldHint": true
}
—Read onlyOpen world—
apitap_searchFind captured API endpoints by domain or keyword. Returns endpoints with replayability tier (green/yellow/orange/red) and endpoint IDs for replay.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "description": "Search query — domain name, endpoint path, or keyword (e.g. \"polymarket\", \"events\", \"get-markets\")"
    },
    "limit": {
      "description": "Maximum results to return (default: 50). Results are ranked by match locality (domain > endpoint > path), replayability tier, then provenance (own captures above imports).",
      "type": "number"
    }
  },
  "required": [
    "query"
  ]
}
Annotations
{
  "readOnlyHint": true,
  "openWorldHint": false
}
—Read onlyClosed world—

Resources 0

  • None observed.

Resource templates 0

  • None observed.

Prompts 0

  • None observed.

Remote endpoints

EndpointTransportAuthenticationHealthObserved
No verified remote endpoint is linked.

ApiTap MCP Server questions

How do I install ApiTap MCP Server?

Install the selected package version with: npm install --save-exact @apitap/core@2.2.2

What tools does ApiTap MCP Server provide?

ApiTap MCP Server exposed 12 tools during independent protocol observation, including apitap_auth_request, apitap_browse, apitap_capture, apitap_capture_finish, apitap_capture_interact, apitap_capture_start, apitap_discover, apitap_peek, and others.

Is ApiTap MCP Server secure?

The selected current version does not yet have completed public verification. Unknown does not mean clean or vulnerable.

Explore related MCP server guides

Curated product and capability guides containing this catalog record.

Browser Automation MCP ServersOfficial vs Community MCP Servers

Let’s talk about MCP security.

Share your details and our security team will contact you.